Well, I got occasional retries on reading the EEPROM (heavily
depending on the clock value), sometimes the firmware appears
to fail, but if it passes, I get full 512 bytes of EEPROM from
an ATmega16 (don't have an ATmega8 handy):

The target is sitting in an STK500. If I use the STK500
itself to read the EEPROM, everything is fine (and fast).

I also tried with the junk fill option of malloc enabled
(this is FreeBSD), to imcrease the probability of hitting
a segfault, but it passes just the same as above.

Can you analyze the segfault with a debugger, to see where
it crashes for you?

By changing line 6448 in avrdude.conf I can read up to 440 bytes of EEPROM. Attempting to read 441 or greater results in the segfault. Luckily I only need the first 89B but anyone who needs >440B is SOL.

avrdude is unable to read the EEPROM from this device. Oddly enough writing and verifying seem to work. It seems more likely to be a problem with avrdude than USBtinyISP because otherwise how would it be able to verify?

Regardless of ihex or any other format it will read several kB of data then segfault at 85%.